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of  the  standards  to  the  functional  failure  modes  showed 
very  little  applicability  to  Child  Access  Prevention  and 
Containment,  Active;  some  indirect  applicability  to  Dispensing; 
Containment,  Passive;  and  Barrier;  good  direct  applicability 
to  Handling  and  Stability;  Identification;  Storage  Control 
and  Structural  Integrity. 

It  is  concluded  that  Containment,  Active  failures 
cannot  be  directly  addressed  in  a standard  because  of 
the  extremely  rigorous  structural  requirements  that  such 
standards  would  impose.  It  is  further  concluded  that 
there  is  an  urgent  need  to  develop  methods  and  standards 
to  child-proof  containers,  to  improve  user  control  of 
dispensing  liquid  from  the  container,  and  to  increase 
the  isolation  of  liquid  in  the  container  from  external 
ignition  sources.  However,  it  is  also  concluded  that 
the  standards  reviewed  provide  a sound  technical  guide 
for  the  handling  and  stability,  structural  integrity  and 
proper  identification  of  containers  for  flammable  and 
combustible  fluids  as  well  as  preventing  unintentional 
release  of  liquids  from  the  container  openings. 
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AN  EVALUATION  OF  SAFETY  STANDARDS  FOR 


GASOLINE  AND  KEROSENE  CANS 


1.  INTRODUCTION 

Accidents  which  involve  flammable  liquids  are  primarily 
related  to  the  nature  of  the  liquids.  These  liquids  are 
both  flammable,  toxic  and  hazardous  as  liquids  and  as 
fumes  independent  of  the  action  of  the  user.  The  accidents, 
however,  are  also  related  to  the  interaction  between  the 
use  of  the  liquids  and  the  characteristics  of  the  containers 
in  which  they  are  stored,  transported  and  handled  and 
from  which  they  are  dispensed.  The  nature  of  this  interaction 
is  critical  to  the  development  of  safety  standards  for 
gasoline  and  kerosene  containers. 

The  purpose  of  this  study  is  to  evaluate  existing 
product  safety  standards  for  gasoline  and  kerosene  containers 
and  to  recommend  provisions  in  areas  not  covered  adequately 
by  these  standards.  The  analysis  is  limited  to  container 
function  as  revealed  by  the  use  of  the  containers.  Two 
previous  studies  at  NBS , Pezoldt  (3)  and  Tyrrell  (4), 
have  provided  quantitative  analyses  of  Container  involvement 
in  gasoline  accidents.  These  studies  are  not  duplicated 
here  although  some  overlap  in  scope  and  content  is  unavoidable 
because  of  similarities  of  data  source  and  interpretation. 

The  analysis  is  further  restricted  to  the  technical  applica- 
bility of  the  standard.  It  is  not  concerned  witjv  the 
feasibility  of  applying  these  standards,  or  suggested 
standards,  to  containers  designed  for  home  use  since  feasi- 
bility goes  beyond  technical  applicability.  T-he  technical 
applicability  of  the  standards  can  be  evaluated  by  a compar- 
ison of  the  provisions  of  'the  standard  with  the  product 
performance  safety  requirements.  The  feasibility  of  applying 
the  standards  to  the  product  is  dependent  upon  such  factors 
as  cost  and  maintainability  which  cannot  be  evaluated 
on  the  basis  of  the  data  available  for  this  study. 

This  study  is  primarily  a description  of  what  users 
do  with  containers  of  flammable  liquid  when  using  the 
liquid  and  how  the  containers  function  or  fail  to  function 
when  so  used.  This  description  is  the  basis  for  the  evaluation 
of  existing  safety  standards  and  recommendations  for  further 
standards . 

Although  the  analysis  in  this  study  is  primarily 
non -quant itat ive  some  quantitative  description  of  the 
data  base  is  presented  to  facilitate  understanding  of 
the  limitations  imposed  by  the  data  on  the  findings  of 


the  study.  This  quantitative  description  is  valid  only 
for  the  data  base,  i.e.,  the  NEISS  data,  FFACT  reports 
and  IDIR's  actually  used,  and  must  not  be  presumed  to 
be  statistically  descriptive  of  the  real  world  of  flammable 
fluid  accidents. 

It  should  be  noted  that  the  data  base  includes  accidents 
with  flammable  and  combustible  liquids  other  than  gasoline 
and  kerosene.  It  is  recognized  that  the  behavior  of  these 
liquids  may  not  be  identical  with  gasoline  and  kerosene 
in  ignition  characteristics.  However,  it  is  felt  that 
there  is  sufficient  similarity  so  that  container  functioning 
can  be  generalized  from  their  behavior  where  they  are 
involved  in  the  accidents  included  in  the  data  base. 

The  study  is  not  directly  a study  of  gasoline  or 
kerosene  containers  per  se  since  only  15  percent  of  the 
containers  involved  in  the  accidents  ca-n  be  identified 
as  gasoline  or  kerosene  containers  designed  as  such.  However, 
the  uses  to  which  all  types  of  containers  were  put,  and 
the  results  of  using  them,  are  analyzed  to  reveal  what 
functions  a container  should  perform  and  what  functional 
failures  should  be  addressed  by  a safety  standard. 

2.  METHOD 

The  data  base  for  the  present  study  consisted  of 
the  following: 

a.  National  Electronic  Surveillance  System 
(NEISS)  data--the  NEISS  data  were  for 
FY  74,  75  and  76  and  were  tabulated  by 
products  (Gasoline,  Kerosene  and  Gasoline 
Cans),  age  of  victim,  and  type  of  injury. 

b.  In-Depth  Investigative  Reports  (IDIR);- 
there  were  134  IDIR's  covering  container 
related  flammable  and  combustible  liquid 
accidents  for  1974,  1975,  1976. 

c.  Flammable  Fabric  Accident  and  Case  Testing 
System  (FFACTS)  narrative  reports - -there 
were  115  reports  covering  container-  related 
flammable  and  combustible  liquid  accidents 

for  1966  through  1973.  FFACTS  data  collection 
was  terminated  in  1974. 

Each  of  these  data  sources  has  a bias  toward  certain 
types  of  accident  injuries.  The  NEISS  data  and,  to  a 
slightly  less  extent  the  IDIR's,  both  derive  from  emergency 
rooms  rather  than  from  burn  centers  or  morgues.  These 
data  thus  somewhat  understate  the  frequency  and  severity 
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of  burn  accidents,  especially  for  small  children  for  whom 
a given  burn  area  comprises  a larger  proportion  of  total 
body  surface  area  than  for  adults.  The  FFACT  reports, 
on  the  other  hand,  are  restricted  to  burn  accidents  and 
thus  do  not  reflect  other  types  of  accidents,  e.g.,  those 
involving  ingestion  or  aspiration  of  liquids. 

This  data  bias  does  not  seriously  interfere  with 
the  analysis  of  container  failure  for  the  purpose  of  this 
study,  although  a larger  number  of  ingestion  and  aspiration 
cases  might  have  been  useful  in  studying  the  role  of  container 
design  in  these  types  of  accidents.  What  is  more  of  a 
handicap  in  the  analysis  of  container  problems  is  that 
the  data  sources  used  emphasize  the  flammable  liquid  aspect 
of  the  accidents  rather  than  the  container  aspects.  The 
containers  are  infrequently  described  in  detail.  Hence, 
the  role  of  the  containers  in  the  accidents  must  often 
be  inferred,  especially  as  to  structural  integrity  and 
details  of  configuration.  Also,  there  are  no  narrative 
accounts  of  cuts,  abrasions,  etc.  from  direct  contact 
with  the  container. 

In  view  of  the  above  limitations  of  the  data  base 
the  identification  of  container  involvement  from  the  IDIR's 
and  FFACT  reports  probably  neglects  some  container  failure 
modes  which  result  in  accidents  in  real  life.  This  is 
especially  true  of  container  failures  due  to  structural 
defect  and  degradation,  e.g.,  seam  failure,  corrosion, 
punctures.  Furthermore,  it  should  not  be  assumed  that 
the  container  involvement  modes  identified  in  this  study 
occur  with  the  same  relative  frequency  in  real  life  as 
they  do  in  the  IDIR’s  and  FFACT  reports. 

The  literature  search  on  flammable  fluid  containers 
resulted  in  only  four  references  of  any  value  to  the  present 
study.  Three  of  these  references,  Pezoldt  (3),  Tyrrell 
(4)  and  Halsey,  Kirstein  and  Snyder  (2)  originated  at 
NBS . The  other  reference,  Greene  and  Cinibulk  (1),  suggested 
the  functional  failure  mode  approach  which  is  used  in 
this  study. 

The  analysis  of  the  data  proceded  as  follows:  summary 

of  NEISS  data,  summary  of  IDIR  and  FFACT  reports,  analytic 
coding,  code  sequencing,  functional  failure  mode  analysis, 
functional  failure  tabulation,  standards  review,  standards 
evaluation . 

The  NEISS  data  were  tabulated  by  product  (gasoline, 
kerosene,  gasoline  container),  for  victim  age  and  type 
of  injury.  This  summary  was  intended  to  describe  the 
general  data  base  for  the  study.  The  description  is  more 
applicable  to  the  IDIR  data  than  to  the  FFACT  data. 
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Each  IDIR  and  FFACT  report  was  summarized  on  a 4"  X 6" 
card.  This  card  was  the  immediate  reference  data  source 
for  all  further  analysis.  Figure  1 is  an  example  of  such 
a report  summary  card.  The  summary  included  the  report 
number,  identification  of  the  liquid,  identification  of 
the  container,  the  age  of  the  operator,  the  operation 
performed  with  the  container,  the  involvement  of  the  container 
in  the  accident,  the  involvement  of  the  liquid  in  the 
accident,  and  the  involvement  of  the  victim  in  the  accident. 
The  report  number  is  an  identifying  number  written  on 
the  copy  of  the  IDIR  or  FFACT  report  used  in  the  study 
and  served  to  retrieve  the  report  for  further  reference 
if  the  summary  card  was  not  sufficient  in  some  detail. 

The  age  of  the  operator,  i.e.,  the  user  or  manipulator 
of  the  container,  was  only  noted  for  children  5 years 
or  younger.  This  age  limit  is  arbitrary  and  is  intended 
primarily  to  identify  a need  for  child  proofing  of  containers. 
The  Operation  entry  states  what  was  done  with  or  to  the 
container . The  C (container)  involvement  entry  states 
the  role  of  the  container  as  a factor  in  the  accident, 
e.g.,  that  it  spilled  gas.  The  L (liquid)  involvement 
entry  states  the  role  of  the  liquid  in  the  accident , e.g., 
that  it  ignited  in  the  can.  The  victim  involvement  entry 
completes  the  accident  picture  by  stating  how  the  accident 
impacted  on  the  victim,  e.g.,  that  he  was  burned  by  ignition 
of  gasoline  on  his  shirt.  The  victim,  in  most  cases, 
is  the  operator  but  his  role  as  a victim  is  of  no  essential 
interest  in  the  analysis  except  as  it  is  relevant  to  the 
performance  of  the  operator,  container  or  liquid. 


No:  149 

Liquid:  Gasoline  Container (s) : Glass  Jar  0 Age: 

Operation:  Poured  gas  on  barbecue  coals. 

Threw  burning  jar  away. 

C involvement:  Gas  ignited  in  jar  from  flashback. 

Gas  spilled  when  jar  was  thrown. 

L involvement:  Ignited  in  jar  and  burned  when 

splashed  from  thrown  jar. 

Victim  involvement:  Burned  by  burning  gasoline 

splashed  from  jar. 


FIGURE  1.  Report  Summary  Card 
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The  information  from  the  summary  card  was  coded  for  type 
of  container,  user  operation,  fire  action  mode,  container 
involvement  mode,  and  injury  mode.  The  coding  was  recorded 
on  the  back  of  the  summary  card.  This  code  is  presented 
in  Appendix  1.  The  sample  summary  shown  by  Figure  1 was 
coded  as  follows: 


1L 

2a 

2d 

3a 

3d 

3h 

4b 

4e 

5c 


Open  top  glass  or  ceramic  container 

Pour  or  spray  liquid 

Throw  or  kick  away  container 

Liquid  interface 

Liquid  or  fumes  to  fire 

Fire  transition  to  container 

Fire  burned  in  container 

Ignited  liquid  splashed  or  spilled 

Victim  injured  by  burning  fluid. 


After  all  summaries  had  been  coded  the  event  codes 
were  placed  in  their  sequence  of  occurrence  for  each  accident. 
This  sequence  was  recorded  on  the  back  of  each  summary 
card.  The  accident  event  code  sequence  for  the  accident 
summarized  in  Figure  1 is: 


' 3a 

2a  | -►  3h  ■+■  4b  2d  ■+■  4e  + 5c 

3d 


In  the  sequence  the  arrows  (-*)  indicate  a sequence  of  events 
and  the  vertical  line  (|)  represents  events  occurring  more  or 
less  simultaneously.  The  sequence  shown  above  can  be 
read  as  follows:  the  operator  poured  the  liquid  (2a), 

there  was  a liquid/fire  interface  (3a)  in  which  the  liquid 
went  to  the  fire  (3d) , the  fire  flashed  back  to  the  container 
(3h) , the  fire  burned  in  the  container  (4b)  , the  operator 
threw  the  container  (2d) , flaming  flquid  splashed  from 
the  container  (4e)  and  the  operator  (victim)  was  burned 
by  the  flaming  liquid  (5c) . 

The  functional  failure  mode  analysis  was  carried 
out  on  the  event  code  sequences  to  reveal  the  ways  in 
which  the  container  did  not  function-  as  an  operationally 
safe  container.  The  functional  failure  mode  analysis 
is  an  adaptation  of  the  Failure  Mode  and  Effect  Analysis 
(FMEA)  approach  to  equipment  safety  assessment.  The  FMEA 
attempts  to  document  potential  failure  modes  of  equipment 
and  to  determine  the  effects  of  each  failure  mode  on  equipment 
safety.  The  FMEA  procedure,  according  to  Greene  and  Cinibulk 
(1) , Page  5,  assumes  that  the  equipment  is  capable  of 
performing  within  specification  requirements  and  that 
no  false  or  erroneous  action  is  initiated  by  the  operator. 


5 


Obviously,  these  assumptions  are  not  met  by  the  equipment 
(containers)  and  the  operators  referred  to  in  the  IDIK's 
and  FFACT  reports.  That  is,  most  of  the  containers  conformed 
to  no  standard  or  specification  relevant  to  flammable 
or  combustible  liquids  and  the  operators  used  both  the 
containers  and  the  liquids  in  a variety  of  inappropriate 
ways.  A strict  FMEA  approach  is  thus  not  appropriate 
here.  However,  the  present  data  analysis  indicates  certain 
functions  which  containers  should  perform  to  reduce  hazards 
in  the  use  and  misuse  of  flammable  and  combustible  liquids. 
The  analysis  also  reveals  the  effects  of  functional  failure. 
These  functions  are  as  follows: 


A.  Child  Access  Prevention  (CAP)  - Prevention  of 
access  to  flammable  or  combustible  liquids  by  a 
person  5 years  of  age  or  younger. 

B.  Dispensing  (D)  - Control  of  the  transition  of 

liquid  to  a selected  destination. 

C.  Containment,  Passive  (CP)  - Prevention  of  the 
unintended  release  of  liquid  or  fumes. 

D.  Barrier  (B)  - Prevention  of  ignition  of  fluid 
within  a container. 

E.  Containment,  Active  (CA)  - Confinement  of  fire, 
flaming  fluid  or  explosion  within  a container. 

F.  Handling  and  Stability  (H-S)  - Positioning,  holding 

and  carrying  control  of  the  container. 

G.  Identification  (I)  - Representation  of  container 

contents  as  flammable,  combustible,  explosive, 
or  toxic. 

H.  Storage  Control  (SC)  - Provision  of  a safe  and  secure 
environment,  including  the  control  and  release  of  vapor 
build-up,  within  the  container  as  relatively  long 

term  holding  facility. 

I.  Structural  Integrity  (SI)  - Preservation  of 
materials,  configuration  and  security  of 
container  and  attachments. 


Each  of  the  accident  sequences  was  analyzed  into 
failures  of  these  functions,  i.e.  functional  failure  modes, 
and  these  functional  failure  modes  were  noted  on  the  summary 
cards.  The  functional  failure  modes,  in  the  accident 
summarized  in  Figure  1 are  Barrier  (B)  and  Containment, 
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Active  (CA) , i.e.,  there  was  a flash-back  (3h)  to  the 
container  which  caught  fire  and  spilled  flaming  gasoline 
( 4 e ) when  it  was  kicked  or  thrown. 

From  the  summary  cards  the  functional  failure  modes 
were  tabulated  as  "subsequences"  involving  that  particular 
failure.  For  example,  the  accident  sequence  illustrated 
in  Figure  1,  breaks  down  into  subsequence  2a->-3h  for  the 
Barrier  functional  failure  and  subsequence  3h+4b+2d-*4 e 
for  the  Containment,  Active  functional  failure.  The  subse- 
quences overlap  in  the  interests  of  giving  a complete 
context  for  the  functional  failures.  The  fire  action 
mode  codes  3a  are  eliminated  since  they  add  no  significant 

(I  ) 

3d 

information  to  the  functional  failure  context.  The  functional 
failure  mode  subsequences  were  tabulated  for  all  accidents. 

Two  of  the  most  comprehensive  standards  of  specific 
applicability  to  flammable  fluid  containers  are  UL  30, 

Standard  for  Safety,  Metal  Safety  Cans,  Underwriters  Labora- 
tory, October  4,  1974,  and  PS  61-74,  Voluntary  Product 
Standard,  Plastic  Containers  (Jerry  Cans)  for  Petroleum 
Products,  American  National  Standards  MH  17.1-1974,  November 
21,  1974.  UL  30  has  also  been  adopted  as  ANSI  Z218.1, 

1971.  Also,  the  Factory  Mutual  Research  Safety  Container 
Standard  and  the  RR-S-30E  Federal  Specification  for  Safety 
Can,  Spring  Closing  Type,  contain  specific  provisions 
which  are  of  special  interest  to  this  analysis  although 
they  generally  parallel  UL  30  for  purpose  of  this  report. 

In  addition,  the  Flammable  and  Combustible  Liquids  Code, 

NFPA  No.  30-1976  gives  certain  basic  definitions  for  flammable 
and  combustible  liquids  and  types  of  container. 

The  provisions  of  the  standards  and  specifications 
noted  above  were  evaluated  as  to  their  applicability  to 
the  functional  failure  sequences.  This  evaluation  was 
carried  out  with  the  assistance  of  Mr.  Emil  Braun  of  the 
Fire  Safety  Engineering  Division,  Institute  of  Applied 
Technology,  National  Bureau  of  Standards.  The  relevant 
provisions  of  these  standards  are  presented  in  Appendix 
2.  The  evaluation  of  these  standards  were  also  the  point 
of  departure  for  recommendations  for  further  standard 
coverage . 

Appendix  3 consists  of  scenarios  for  each  of  the 
functional  failure  modes.  These  scenarios  are  presented 
to  provide  a more  complete  picture  of  the  accident  events 
since  the  failure  mode  subsequences  presented  in  Tables 
III  through  XVIII  are  necessarily  somewhat  fragmentary. 
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3.  RESULTS 


The  type  of  injury  distribution  for  the  NEISS  data 
is  shown  in  Table  I.  This  data  base  is  sampled  more  inten- 
sively by  the  IDIR's  than  it  is  by  the  FFACT  reports. 

While  only  32  percent  of  the  accidents  tabulated  in  Table 
I involved  thermal  burn  injuries,  80  percent  of  the  combined 
IDIR  and  FFACT  reports  involved  thermal  burn  injuries. 

This  can  be  interpreted  to  mean  that,  for  the  sample  of 
reports  analyzed  in  the  present  study,  the  thermal  burn 
understatement  of  the  IDIR  data  base  is  compensated  for 
by  the  thermal  burn  overstatement  of  the  FFACT  reports. 

This  does  not  necessarily  indicate  that  the  accident  report 
data  base  for  this  study  is  representative  of  flammable 
fluid  container  involvement  in  real  life  accidents,  even 
for  type  of  accident.  It  does,  however,  indicate  that 
the  accident  report  data  base  includes  an  important  segment 
of  possible  accidents  and  can  be  used  as  a basis  for  at 
least  some  standard  evaluation.  For  example,  while  the 
proportion  of  Dispensing  failure  modes  vs  the  proportion 
of  Handling  and  Stability  failure  modes  identified  in 
the  data  base  may  not  be  reflected  in  the  real  world  of 
accidents,  it  is  a reasonable  assumption  that  both  of 
these  types  of  accident  events  do  occur. 

There  is,  however,  one  major  point  of  similarity 
between  the  NEISS  data  in  Table  I and  the  combined  data 
from  the  IDIR's  and  FFACT  reports:  86  percent  of  children 

under  five  years  of  age  in  the  NEISS  data  and  86  percent 
of  the  children  five  years  of  age  and  under  in  the  combined 
IDIR  and  FFACT  data  were  victims  of  flammable  fluid  ingestion. 
This  is  probably  a slight  overstatement  for  the  IDIR- 
FFACT  data  since  victims  were  not  counted  in  this  study 
unless  they  were  also  operators,  i.e.,  a number  of  small 
child  burn  victims  were  not  counted  whereas  all  small 
child  ingestion  victims  were  counted.  In  both  sets  of 
data  the  proportion  of  ingestion  victims  drops  off  sharply 
after  the  five  year  old  group.  Although  quantitative 
results  must  be  treated  very  cautiously  in  this  report, 
it  seems  reasonable  to  say  that  ingestion  is  the  flammable 
fluid  hazard  with  which  young  children  are  most  frequently 
involved  and  is  primarily  a young  child  problem. 

Table  II  presents  the  functional  failure  mode  distribution 
by  type  of  container  for  the  IDIR's  and  FFACT  reports. 

Cases  involving  operators  five  years  of  age  or  younger 
were  tabulated  only  for  Child  Access  Prevention  and  any 
other  functional  failure  modes  for  these  51  cases  are 
not  included  elsewhere  in  the  tabulations.  This  does 
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not  result  in  a major  understatement  for  any  of  the  other 
functional  failure  modes  except  Identification,  for  which 
the  tabulation  does  not  include  19  cases  of  misidentif icat ion 
included  in  the  cases  tabulated  as  Child  Access  Prevention 
failures.  Structural  failure  modes  could  not  be  frequently 
identified  in  the  accident  reports.  Only  three  cases 
of  Structural  Integrity  and  two  cases  of  Storage  Control 
failure  were  directly  identified.  However,  as  noted  before, 
neither  the  FFACT  reports  nor  the  IDIR's  were  container 
oriented  and  most  of  the  containers  used,  e.g.,  open  top 
deep  or  shallow  containers,  were  more  configurationally 
than  structurally  hazardous  as'  flammable  liquid  receptacles. 
Thus,  the  data  source  was  not  adequate  for  identification 
of  structural  defects  in  containers.  However,  Table  II 
can  and  does  illustrate  the  presence  of  "operational” 
failures,  i.e.,  Dispensing;  Containment,  Passive;  Barrier; 
and  Containment,  Active,  across  all  types  of  containers, 
including  those  identified  as  "standard".  While  the  format 
of  Table  II  does  not  directly  show  cross  relationships 
between  functional  failure  modes,  certain  associations 
were  found  in  the  data  base.  For  example,  a Barrier  failure 
mode  was  usually  associated  with  a Containment,  Active 
failure  and  about  two  thirds  of  the  Handling  and  Stability 
failures  were  associated  with  Containment,  Passive  failures. 
These  associations  are  rather  obvious.  A Containment, 

Active  function  does  not  usually  become  relevant  unless 
a Barrier  function  fails.  Also,  a Handling  and  Stability 
function  failure,  e.g.,  a dropped  container,  is  conducive 
to  a Containment,  Passive  function  failure,  e.g.,  spillage. 

By  contrast,  a Dispensing  function  failure  usually’  occurs 
without  any  obvious  relationship  to  other  failure  modes. 

It  is  not,  by  definition,  a Containment,  Passive  function, 
does  not  usually  lead  to  a container  fire  and  cannot  usually 
be  identified  from  the  accident  report  as  being  due  to 
a Handling  and  Stability  failure  or  a Structural  Integrity 
failure  although  both  of  them  may  actually  have  been  involved. 

Tables  III  through  XVIII  present  the  subsequences 
of  events  within  which  the  functional  failure  modes  were 
identified  from  the  IDIR's  and  FFACT  reports.  Each  table 
presents  a variation  of  a functional  failure  mode.  The 
first  column  shows  the  subsequence  codes  which  outline 
the  failure- mode , the  next  column  describes  the  events 
coded  in  the  subsequence  and4the  last  column  shows  the 
number  of  cases  in  which  this  subsequence  was  identified. 

The  last  column  serves  to  identify  points  for  discussion 
but  is  not  a statement  of  the  frequency  of  occurrence 
of  these  events  in  real  life  accidents. 
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The  recording  and  analysis  of  accident  reports  after 
the  event  is  not  a highly  valid  way  of  determining  what 
actually  occurred  in  accidents.  However,  for  present 
purposes,  the  subsequences  may  be  regarded  as  credible 
in  that  such  combinations  of  events  do  occur.  Therefore, 
the  material  presented  in  Tables  III  through  XVIII  can 
be  used  as  a basis  for  a realistic  discussion  of  the  adequacy 
of  safety  standards. 

Tables  III  and  IV  present  functional  failure  mode 
subsequences  for  the  Child  Access  Prevention  function 
for  ingestion  and  personal  contact  and  burn  events,  respec- 
tively. The  predominant  ingestion  method  employed  (32 
cases)  was  drinking  directly  from  the  container  in  which 
the  child  found  the  liquid.  In  15  of  these  32  cases, 
there  is  reason  to  believe  that  the  child  misidentif ied 
the  container  as  one  containing  a normally  potable  liquid. 

In  the  burn  cases,  the  child  directly  ignited  the  fluid 
in  the  container,  poured  the  liquid  and  ignited  it  or 
poured  the  liquid  near  an  ignition  source.  The  basic 
preventive  measure  for  all  variations  of  the  Child  Access 
Prevention  failure  mode  is  child  proofing  of  all  containers 
containing  flammable  liquids.  Identification  of  such 
containers  is  always  desirable  but  is  not  a sufficient 
preventive  measure,  in  itself,  where  the  small  child  is 
involved . 

Table  V presents  functional  failure  mode  subsequences 
for  the  Dispensing  function  in  which  liquid  was  splashed 
or  spilled  on  either  or  both  the  person  or  the  area. 

In  none  of  these  cases  was  the  liquid  ignited  at  the  time 
of  spillage.  In  41  of  the  cases  there  was  a misdirection 
of  pouring.  In  four  cases  siphoning  was  involved.  The 
basic  remedial  approach  to  all  such  problems  would  seem 
to  be  to  improve  spout  design  to  increase  control  of  pouring 
and  to  eliminate  the  need  for  siphoning. 

Tables  VI,  VII,  VIII  and  IX  present  functional  failure 
mode  subsequences  for  the  Containment,  Passive  function 
in  which  unignited  liquid  or  fumes  are  splashed  or  spilled 
on  the  person  (Table  VI),  phe  area  (Table  VII),  on  both 
person  and  area  (Table  VIII),  or  ’'other”  (Table  IX). 

No  one  or  more  predominant  subsequences  were  found  for 
any  variation  on  the  Containment,  Passive  failure  mode. 

The  containers  were  jerked  when  the  operator  was  startled, 
dropped,  upset,  thrown,  kicked,  washed  in  and  transported. 

The  basic  remedy  to  prevent  this  failure  mode  would  seem 
to  be  a container  design  and  construction  that  would  prevent 
any  release  of  liquid  (including  by  leakage)  except  while 
the  operator  was  deliberately  activating  such  a release, 
i.e.,  a "dead  man  control”  provision.  Even  such  design 


10 


and  construction  would  not  always  terminate  release  of 
liquid  if  a startle  reaction  occurred  while  the  operator 
was  activating  release. 


Tables  X and  XI  present  functional  failure  mode  subse- 
quences for  the  Barrier  function  in  which  fire  transitions 
to  the  container  (Table  X)  and  in  which  the  liquid  is 
directly  ignited  in  the  container  (Table  XI).  There  are 
two  dominant  patterns  in  Table  X,  one  in  which  a flashback 
occurs  while  pouring  liquid  on  a fire  and  the  other  in 
which  a container  releases  liquid  or  fumes  to  a general 
area  in  which  an  ignition  source,  such  as  a pilot  light, 
is  located  and  a flashback  to  the  container  occurs.  In 
direct  ignition  of  fluid  in  a container  (Table  XI)  the 
usual  pattern  of  events  is  for  a fire  source,  for  example, 
a spark,  to  directly  contact  the  liquid  or  fumes  in  the 
container.  Both  varieties  of  Barrier  mode  failure  might 
be  prevented  by  a filter  or  valve  in  the  spout  of  the 
container . 


Tables  XII,  XIII,  and  XIV  present  functional  failure 
mode  subsequences  for  the  Containment,  Active  function 
in  which  the  container  releases  ignited  fuel  (Table  XII), 
fails  to  contain  an  explosion  within  the  container  (Table 
XIII)  or  fails  to  contain  a fire  within  the  container 
(Table  XIV).  The  containment  of  ignited  fuel,  provided 
no  explosion  occurs,  might  be  adressed  by  the  same  design 
and  construction  standards  as  for  the  Containment,  Passive 
function.  Containment  of  fire  is  a more  rigorous  requirement, 
even  if  no  explosion  takes  place.  The  containment  of 
an  explosion  is  probably  not  a reasonable  requirement 
to  impose  upon  container  design  and  structure  and,  therefore, 
should  not  be  incorporated  in  a standard.  At  a recent 
1977  Engineering  Foundation  Conference  on  Product  Safety, 
Franklin  Pierce  College,  New  Hampshire,  there  was  discussed* 
a container  design  consisting  of  a coil  of  perforated 
metal  sheets  inside  a container.  This  design  was  presented 
as  a measure  to  limit  fire  action  within  a container  and 
prevent  an  explosion  from  developing.  However,  this  device 
has  not  been  further  reported  upon.  Probably  the  most, 
and  possibly  only,  feasible  approach  to  reducing  or  eliminating 
Containment,  Active  function  failures  is  to  enhance  the 
operation  of  the  Barrier  function. 


*Personal  communication,  Dr.  II. P.  Van  Cott,  Chief,  Human  Factors 
Section,  Product  Systems  Analysis  Division,  Center  for  Consumer 
Product  Technology,  National  Bureau  of  Standards,  Washington, 
D.C.  20234 
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Table  IV  presents  functional  failure  mode  subsequences 
for  the  Handling  and  Stability  function.  The  containers 
were  knocked  over  or  dropped  during  pouring  or  transport 
or  by  being  bumped  into  while  not  in  use.  The  frequency 
of  dropping  a container  can  be  reduced  by  handle  design 
and  placement.  The  knock  over  problem  is  a matter  of 
stability  design,  probably  to  a large  extent  configurational. 
The  enhancement  of  the  Containment,  Passive  function  would, 
of  course,  reduce  the  spillage  problem  from  Handling  and 
Stability  related  accidents. 

Table  XVI  presents  functional  failure  mode  subsequences 
for  the  Identification  function.  As  noted  before,  most 
of  Identification  problems  are  associated  with  liquid 
ingestion  by  small  children.  table  XVI  pertains  only 
to  older  persons.  None  of  the  cases  in  Table  XVI  involved 
ingestion.  Since  the  IDIR’s  and  FFACT  reports  for  adults 
analyzed  for  the  present  study  are  usually  for  cases  in 
which  the  operator  presumably  knew  what  the  liquid  was 
and  what  he  wanted  to  use  it  for,  one  would  expect  to 
find  relatively  few  cases  of  mis ident if icat ion  of  the 
liquid.  Nevertheless,  clear  identification  of  flammable 
fluid  containers  is  an  obvious  safety  requirement. 

Table  XVII  presents  functional  failure  mode  subsequences 
for  the  Storage  Control  function.  These  failures  can 
be  expected  to  be  reported  relatively  infrequently  in 
personal  injury  accident  reports  since  there  is  relatively 
little  direct  personal  contact  with  a container  in  storage. 
Storage  accidents  would  tend  to  be  reflected  in  property 
damage  reports  in  which  personal  injury,  if  any,  would 
tend  to  be  attributed  to  products  other  than  flammable 
liquids  or  containers.  The  remedy  for  storage  control 
failure  probably  lies  in  container  structural  and  design 
requirements.  It  should  be  noted  that  some  advocates 
of  plastic  je  rry  cans  claim  that  expansion  of  the  plastic 
can,  along  with  expansion  of  the  liquid  contained  therein, 
tends  to  reduce  the  chance  of  container  rupture  when  the 
temperature  of  the  storage  area  rises. 

Table  XVIII  presents  functional  failure  mode  subsequences 
for  Structural  Integrity.  In  one  case  a handle  fitting 
allowed  leakage,  in  another  case  a glass  container  broke 
when  dropped  and  in  the  third  case  a plastic  container 
melted  or  burned.  As  noted  before,  the  IDIR's  and  FFACT 
reports  are  not  container  oriented  and  thus  do  not  identify 
many  container  failures.  Also,  in  many  of  the  cases  analyzed, 
the  accident  was  primarily  related  to  the  configuration 
of  the  container  involved  rather  than  to  its  structural 
defects . 
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The  applicability  of  the  provisions  of  the  UL  30, 

Metal  Safety  Can,  the  PS  6174,  Plastic  Jerry  Can,  and 
the  Factory  Mutual  Safety  Containers  Standard,  and  the 
RR-S-30F  Safety  Cans  Specification  to  the  functional  failure 
modes  is  summarized  in  Table  XIX.  Table  XIX  is  based 
on  Table  I,  Appendix  2,  but  the  reader  should  go  to  the 
standards  themselves  for  detailed  information  on  specific 
paragraphs . 

Neither  UL  30  or  PS  6174  has  any  specific  provisions 
directly  or  indirectly  related  to  Child  Access  Prevention. 

The  color  and  identification  provisions  of  the  Federal 
Hazardous  Substances  Act  may  help  in  teaching  a small 
child  what  to  avoid  but  they  may  also  make  the  container 
more  attractive  to  the  child. 

The  UL  30  standard  has  spout  provisions  which  probably 
make  pouring  stream  control  more  effective  for  the  Dispensing 
function.  The  PS  6174  standard  has  only  a general  requirement 
for  a spout.  The  provisions  in  UL  30,  Factory  Mutual, 
and  RR-S-30F  for  Automatic  Valve  Closure  with  manual  valve 
opening  probably  would  enhance  Dispensing  control. 

The  Containment,  Passive  function  is  covered  in  UL 
30  by  provisions  for  containment  capacity,  valve  action 
and  spout  leakage.  These  same  provisions  are  generally 
in  PS  6174  with  the  exception  of  any  reference  to  valve 
action.  Structural  integrity  provisions  in  both  standards 
are  generally  applicable  to  Containment,  Passive.  The 
automatic  closing  valves  specified  in  the  UL  30  and  Factory 
Mutual  Standards  and  the  RR-S-30F  Specification  seem  to 
be  an  approach  to  a "dead  man  control"  of  liquid  release 
through  the  spout . 

There  is  no  specific  provision  for  a Barrier  function 
in  either  UL  30  or  PS  6174.  However,  it  is  the  opinion 
of  Mr.  Emil  Braun,  Fire  Safety  Engineering  Division,  National 
Bureau  of  Standards,  that  the  screens  or  strainers  specified 
in  UL  30,  paragraphs  12.1  and  12.2,  might  be  adapted  as 
a flashback  barrier  or  a barrier  to  direct  ignition  of 
the  interior  of  the  container  via  the  spout.  This  is 
probably  the  intent  of  the  Flame  Arrester  provision  and 
Fire  Exposure  test  in  both  RR-S-30E  and  the  Factory  Mutual 
Standard . 

. There  are  no  provisions  in  these  standards  directly 
applicable  to  the  Containment,  Active  function.  General 
structural  integrity  provisions  are  somewhat  relevant 
and  the  effective  containment  of  unignited  liquid,  i.e., 
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Containment,  Passive,  might  also  somewhat  restrict  the 
release  of  burning  fluid.  However,  it  is  probably  unrealistic 
to  impose  strict  standards  on  containment  of  fire  or  burning 
fluid  within  a container  or  to  require  any  containment 
of  an  explosion  within  a container,  since  such  standards 
would  require  a greater  structural  and  material  strength 
than  would  be  feasible  in  portable  containers. 


Handling  and  Stability  are  considered  in  the  standards 
as  different  topics.  Handling  is  covered  by  the  UL  30 
in  terms  of  placement  and  configuration  of  handles  to 
enhance  security  in  carrying  the  containers  and  to  provide 
a top  and  bottom  container  grip  placement  for  control 
in  manipulating  the  container.  PS  6174  specifies  only 
that  a handle  shall  be  provided.  The  UL  30  handle  requirements 
would  seem  to  reduce  the  number  of  incidents  from  dropped 
containers.  They  would  also  facilitate  control  of  pouring 
and  thus  reduce  Dispensing  functional  failures. 

Stability,  in  both  UL  30  and  PS  6174  is  considered 
as  static  stability  on  an  inclined  plane,  of  30  and  20 
degrees,  respectively.  UL  30  also  specifies  a design 
for  stability  in  which  the  diameter  of  the  base  of  the 
can  shall  not  be  less  than  85  percent  of  the  height  of 
the  body  of  the  can.  These  provisions  are  directly  applicable 
to  a static  test  of  stability  in  which  a container  is 
passively  placed  on  a sloping  surface.  They  may  not, 
however,  give  full  consideration  to  a more  dynamic  type 
of  stability  in  which  a container  is  kicked  or  knocked 
over  to  an  angle  and  is  subsequently  required  to  fall 
back  on  its  base.  This  might  be  a more  severe  test  of 
stability  than  a static  incline  test,  especially  if  there 
was  liquid  "slosh"  within  the  container.  The  Factory 
Mutual  Standard  and  the  RR-S-30F  Specification  provide 
for  tilting  the  can  to  30°  and  requiring  it  to  fall  back 
to  an  upright  position.  This  test  would  seem  to  be  more 
applicable  to  dynamic  stability. 


Identification  is  not  touched  upon  in  UL  30.  PL 
6174  refers  to  the  Federal  Hazardous  Substances  Act. 

This  referral  seems  adequate  as  a specification  for  identifi- 
cation of  flammability  and  toxicity.  In  fact,  a survey 
of  gasoline  containers  for  sale  in  drug  stores,  hardware 
stores,  farm  supply  stores,  and  elsewhere  shows  that  these 
containers  are  generally  well  identified  for  their  use. 


by 

PS 


The  Storage  Control  function  is  generally 
the  Structural  Integrity  provisions  of  both 
6174.  In  fact,  these  standards  are  largely 


covered 
UL  30  and 
structural 
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standards.  Both  cover  materials,  coating,  leak  proofing, 
and  an  extensive  program  of  structural  testing.  In  addition, 
PL  6174  deals  with  melting,  brittleness  and  flammability 
requirements . 

Halsey,  Kirstein  and  Snyder  (2)  have  reviewed  the 
provisions  on  handling,  stability  and  structural  integrity 
of  the  standards  cited  in  this  report  and  have  performed 
tests  on  several  containers.  Their  primary  objective 
was  to  determine  if  these  standards  could  be  applied  to 
containers  for  home  use.  Their  conclusions,  as  stated 
in  their  concluding  remarks,  are  quoted  below: 

"The  purpose  of  this  study  was  to  determine 
the  feasibility  of  transferring  the  technology 
involved  in  voluntary  standards  for  safety  cans 
to  standards  for  flammable  liquid  containers  for 
home  use.  In  general,  the  results  of  this  study 
on  the  mechanical  tests  for  stability,  leakage, 
and  handle  strength  indicate  that  reasonable 
performance  standards  for  these  characteristics 
can  be  developed  for  flammable  liquid  containers 
for  home  use.  It  remains,  of  course,  for  CPSC 
to  establish  appropriate  pass-fail  criteria  for 
the  tests. 

The  results  of  the  pour  spout  strength 
tests  did  not  appear  to  apply  directly  to 
containers  for  home  use  unless  it  is  deemed 
necessary  or  desirable  to  require  that  these 
containers  be  equipped  with  valves  similar 
to  those  used  on  safety  cans.  On  the  other 
hand,  the  results  of  these  tests  and  the 
associated  inverted  can  leakage  tests  did 
accent  the  need  for  leak-proof  caps  and 
extension  spouts.  Leak-proof  caps  and 
extension  spouts  are  important  not  only 
because  of  liquid  leakage  in  an  inverted  or 
upset  position,  but  also  because  of  the 
possibility  of  vapor  leakage  in  the  upright 
position  and  liquid  leakage  frojn  the  cap 
or  extension  spout  while  decanting. 

v ' 

The  referenced  voluntary  standards  and 
specifications  [1,  2,  3,  and  4]  provide 
additional  considerations  which  may  be 
* necessary  to  produce  a meaningful  standard 
for  flammable  liquid  containers  for  home 
use.  Further  studies  along  these  lines 
could  address  features  such  as  air  vent 
openings,  pressure  relief  valves,  flame 
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arresting  screens,  protective  coatings, 

material  properties,  capacity,  fire 

exposure,  color,  and  markings." 

4.  CONCLUSIONS  AND  RECOMMENDATIONS 

The  analysis  of  the  IDIR’s  and  FFACT  reports  which 
form  the  data  base  for  this  study  has  led  to  the  identifi- 
cation of  nine  major  functional  failure  modes  of  flammable 
fluid  containers.  These  modes  are  failures  in  the  following 
functions  with  the  associated  consequences: 

1.  Child  Access  Prevention.  A failure  results 
in  ingestion  of  flammable  liquid  and  burn 
accidents  by  small  children. 

2.  Dispensing.  A failure  leads  to  lack  of 
control  of  pouring  or  other  transfer  of 
liquid  from  a container. 

3.  Containment,  Passive.  A failure  leads  to 
leakage  or  spillage  of  unignited  liquid 
on  the  person  or  in  an  area. 

4.  Barrier.  A failure  leads  to  ignition  of 
liquid  within  a container. 

5.  Containment,  Active.  A failure  leads  to 
spillage  of  burning  liquid,  exposure  to  a 
container  fire  or  exposure  to  an  explosion 
in  the  container. 

6.  Handling  and  Stability.  A failure  leads  to 
lack  of  control,  dropping  or  upsetting  a 
container . 

7.  Identification.  A failure  leads  to  treating 
a flammable  liquid  as  a safe  liquid. 

8.  Storage  Control.  A failure  leads  to  a 
flammable  fluid  accident  during  relatively 
passive  storage. 

9.  Structural  Integrity.  A failure  leads  to 
breakdown  of  a container  as  a handling  or 
storage  device. 

An  analysis  of  the  applicability  of  the  provisions 
of  the  UL  30  Metal  Safety  Can,  the  PL  6174  Plastic  Jerry 
Can  and  the  Factory  Mutual  Safety  Container  Standards, 
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and  the  RR-5-30F  Federal  Specification  on  safety  cans 
to  these  functional  failure  inodes  leads  to  tne  following 
conclusions : 

1.  The  standards  have  no  applicability  to 
Child  Access  Prevention. 

2.  The  standards  have  some  applicability  to 
Dispensing,  primarily  in  the  provisions  for 
spout  and  valve  design,  operation  and  structure. 

3.  The  Structural  Integrity  and  valve  provi- 
sions of  the  standards  are  a possible  approach 
to  the  Containment,  Passive  function,  especially 
if  automatic  valve  action  results  in  a ’’dead  man 
control"  of  liquid  release  through  the  spout. 

4.  The  screening  and  valve  provisions  of  the 
UL  30  standards  suggests  a possible  line 

of  improvement  of  Barrier  functions,  as  also 
do  the  flame  arrester  provisions  of  RR-S-30F 
and  the  Factory  Mutual  Standard. 

5.  It  is  not  realistic  to  directly  address 
the  Containment,  Active  function  in  a 
standard  since  this  would  involve  unrealistic 
material  and  structural  requirements. 

6.  The  handle  design  and  placement  provisions 
of  UL  30  seem  fairly  adequate  for  setting 
requirements  for  container  manipulation 
and  transport.  However,  the  stability 
requirements  of  the  standards  may  not  ade- 
quately address  dynamic  instability  of  con- 
tainers, although  a tilt  test  of  stability, 
as  in  the  Factory  Mutual  Standard,  may  be 
considered  a dynamic  test. 

7.  The  reference  in  PL  6174  to  the  provisions 
of  the  Federal  Hazardous  Substances  Act 
seem  to  adequately  address  the  Identifi- 
cation function.  However,  this  reference 
should  be  incorporated  in  UL  30. 

The  analysis  of  the  accident  data  and  the  evaluation 
of  the  standards  for  containers  for  flammable  and  combustibl 
liquids  suggests  that  there  is  an  urgent  need  to  develop 
methods  and  standards  for  child  proofing  these  containers, 
making  the  containers  more  ignition  proof  and  giving  the 
user  of  the  container  control  over  the  transition  of  the 
liquid  from  container  to  objective.  Present  standards 
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seem  to  be  generally  adequate  for  container  handling  and 
stability  and  structcral  integrity  and  to  be  specifically 
applicable  to  prevention  of  unintentional  release  of  contain  ;r 
contents . 


5.  TABLES 

This  section  contains  all  tables  referred  to  elsewhere 
in  this  report,  except  for  the  Standards  Summary  table 
in  Appendix  2.  The  tables  are  made  available  in  this 
way  for  reader  convenience  and  to  avoid  disrupting  the 
text  format  of  the  main  body,  of  the  report. 
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TYPE  OF  CONTAINER  vs  FUNCTIONAL  FAILURE  MODE  ACCIDENT  DISTRIBUTION 
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•Child  Access  Prevention  includes  19  cases  of  misidentification 


FUNCTIONAL  FAILURE  MODE  SUBSEQUENCE  - -CHILD  ACCESS  PREVENTION 
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released  in  area,  liquid  burned  in  place 
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2g-*4c-*2b-*-3j  Handled  liquid,  liquid  spilled  on  person,  ignited  liquid, 

direct  container  ignition 
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2d-»-4d-*3e  Threw  or  kicked  container,  liquid  or  fumes  released  in  area, 

exploded  in  place 
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Factory  Mutual  Par. 1.1  Automatic  valve  closing  provides  a possible 

cut-off  for  spout  and  other  openings  when  c 
not  held  by  operator. 
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PS  6174  Structural  integrity  provisions  are  generally  relevant. 
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APPENDIX  1 


ACCIDENT  EVENT  CODING 

The  following  coding  system  was  developed  and  utilized 
during  the  analysis  of  the  IDIR's  and  FFACT  accident  reports 
in  this  study.  While  all  of  the  coding  items  were  considered 
in  the  accident  event  analyses  and  sequences,  some  of 
the  items  were  not  included  in  tabulating  the  functional 
failure  mode  subsequences  since  they  did  not  appear  to 
provide  significant  information  concerning  the  functional 
failure  mode.  These  omissions  are  indicated  by  an  asterisk(*) 
in  the  following  list. 


Code 

Title 

Description 

1 

Type  of  Container 

The  container  utilized  by  the 
operator  to  pour,  carry,  etc. 
the  liquid. 

la 

Standard  gasoline 

The  type  of  container  usually 

or  kerosene 

sold  in  retail  stores  as  a 
gasoline  or  kerosene  can. 

lb 

Spout  can  - metal 

A container  with  an  enclosed 

lc 

Spout  can  - glass 

pouring  spout  and  constructed 

Id 

Spout  can  - plastic 

of  material  as  noted,  but  not 
identifiable  as  la. 

le 

Spout  can  - unknown 

If 

Small  mouth  jar 

A container  with  a relatively 

or  can  - metal 

large  capacity  body  and  a 

lg 

Small  mouth  jar 

small  top  opening  for  filling 

or  can  - glass 

and  dispensing,  e.g.,  a plastic 

lh 

Small  mouth  jar 

milk  jug,  constructed  of 

or  can  - plastic, 

material  as  noted. 

cardboard,  paper 

■ 

li 

Small  mouth  jar 
or  can  - unknown 

lj 

Bottle 

A container  with  a standard 
bottle  conf igurat ion , e.g.,  a 
soft  drink  bottle. 

lk 

Open  top,  deep  - 

A container  in  a wide  mouth, 

metal 

open  top  configuration  con- 

11 

Open  top,  deep  - 

structed  of  material  as  noted, 

glass  ceramic 

e.g.,  a drinking  glass,  tin 

lm 

Open  top,  deep  - 
plastic,  paper 
cardboard 

can,  pail. 
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In 

Open  top,  deep  - 
unknown 

lo 

Ip 

lq 

Open  top,  shallow 

- metal 

Open  top,  shallow 

- glass,  ceramic 
Open  top,  shallow 

- plastic 

A container  in  a pan  or  semi 
tray  configuration  constructed 
of  material  as  noted,  e.g.,  a 
paint  roller  tray. 

Ir  ' 

Open  top,  shallow 
- unknown 

-■ 

Is 

Unknown 

Unidentifiable  from  the  report. 

2 

User  Operation 

The  activity  carried  out  with  or 
on  the  container  and  liquid  by  the 
user  of  the  liquid,  i.e.,  the 
operator . 

2a 

Pour  or  Spray  - 

Transmit  the  liquid  from  the 
can  intentionally 

2 b 

Ignite 

Directly  apply  flame  to  the  liquid, 
either  in  the  container  or  elsewhere 

2c 

Startle 

Jump  back  or  otherwise  move  sud- 
denly with  more  or  less  the  whole 
body . 

2d 

Throw  or  kick 
away 

Propel  the  container  through  the 
air  other  than  by  knocking  it  over 
or  off  of  a support . 

2e 

Ingest 

Drink  or  aspirate  liquid 

2el 

Ingest,  spill 

Spill  liquid  from  container  and 
ingest 

2e2 

Ingest  from  con- 
tainer 

Drink  directly  from  container 

2e3 

Container  transfer 

Transfer  liquid  to  a second  container 
and  drink  from  second  container 

2e4 

Open  container 

Open  container  to  ingest  liquid 
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2f 

Transport 

Move  the  container  from  one 
place  to  another  or  passively 
hold  container. 

2g 

Handle  liquid 

Deliberately  contact  liquid  with 
some  part  of  person,  e.g.,  clean- 
ing with  liquid 

2h 

Siphon 

Transfer  liquid  from  a container 
by  hose  and  suction  method 

2i 

Upset  or  drop 
container 

Overturn  container  or  accidentally 
let  it  fall 

2j 

Passive 

Not  actively  using  or  interfacing 
with  container  or  liquid 

2k 

Misident ify 

Mistake  liquid  for  something  other 
than  what  it  is  because  of  nature 
of  container  or  circumstances. 

3 

Fire  action  mode 

The  interface  with  the  fire  by  liquid, 
container  or  person. 

*3a 

Liquid  interface 

Interface  with  fire  by  liquid  directly 

*3b 

Fume  interface 

Interface  with  fire  by  fumes  only 
or  primarily 

*3c 

Fire  to  liquid 
or  fumes 

Fire  applied  to  liquid,  e.g.,  a 
spark  into  container 

*3d 

Liquid  or  fumes 
to  fire 

Liquid  or  fumes  applied  to  fire,  e.g., 
pouring  liquid  onto  coals 

3e 

Explode  in  place 

A localized  explosion  which  is  not 
generalized  or  in  the  container 

3£ 

Burn  in  place,  only 

A localized  "puddle"  fire 

3g 

Transition  to 
person 

Ignition  of  person  through  a flashback 
along  a stream  of  liquid/fumes 

3h 

• 

Transition  to 
container 

Ignition  in  container  through  a 
flashback  along  a stream  of  liquid/ 
fumes . 

3i 

Direct  person 
ignition 

Direct  ignition  of  person,  e.g.,  from 
previously  spilled  gas  on  person 
ignited  by  a spark 
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3j 

Direct  container 
ignition 

Direct  ignition  of  liquid/fumes  in 
container,  e.g.,  from  a spark 
entering  a container. 

4 

Container  involve- 
ment mode 

The  direct  participation  in  or 
interface  of  a container  with 
accident  events 

4a 

Explode 

Explosion  of  the  container  from 
ignition  of  liquid/fumes  within 
container.  Usually  includes  4e. 

4b 

Burn  in 

Ignition  and  burning  of  liquid  in 
container  but  without  an  identi- 
fiable explosion 

4c 

Splash/Spill,  pre- 
ignition, person 

Release  non-ignited  fluid  from 
container  to  person 

4d 

Splash/Spill,  pre- 
ignition, area 

Release  of  unignited  liquid  or 
fumes  to  area 

4e 

Splash/ Spill  - Igni - 
ted  or  in  ignition 
process 

Release  of  flaming  liquid,  or 
immediately  ignited  liquid,  to 
person  or  area,  also  included  in  4a. 

4f 

Melt/burn 

Ignition  of  material  of  container 

4g 

Liquid  access/ 
transfer 

The  role  of  the  configuration  or 
structure  of  the  container  in 
permitting  access  to  liquid  or 
influencing  transfer  of  liquid 
from  one  container  to  another. 

4h 

Storage 

The  characteristics  of  a container 
as  a holding  facility  for  liquid. 

4i 

Container  failure 

Structural  or  material  failure 
of  the  container 

4j 

Splash/Spill,  no 
ignition 

Release  of  liquid  to  person  or  area 
with  no  subsequent  ignition 

5 

Injury  mode 

Immediate  source  of  injury  to  victim 
from  accident 

*5a 

Explosion  - direct 

Injury  from  direct  effects  of  an 
explosion 
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*5b 

Burn  - direct 

Injury  from  direct  contact  with  a fire 

* 5 c 

Burning  fluid 

Injury  from  burning  liquid  splashed 
or  spilled  on  person 

*5d 

Fluid  on  person 
ignited 

Injury  resulting  from  ignition  of 
liquid  splashed  or  spilled  on  person 
prior  to  ignition 

* 5e 

Container  burn 

Injury  from  contact  with  a hot, 
melting  or  burning  container 

*5f 

Ingestion  - direct 

Injury  from  drinking  or  aspirating 
spilled  liquid  or  liquid  from  a 
container 

*5g 

Ingestion  - siphon 

Injury  from  ingestion  or  aspiration 
of  liquid  from  a siphoning  hose 

*5h 

Liquid  contact 

Injury  from  skin  contact  with  liquid 

* 5i 

Other 

Injury  other  than  above,  e.g.,  a 
heart  attack  precipitated  by  reaction 
to  an  explosion 

*5j 

None  apparent 

No  further  injury  identified  from 
the  accident  report 
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APPENDIX  2 


STANDARDS  SUMMARY 

The  basic  definitions  of  flammable  and  combustible 
liquids  and  containers  far  this  study  are  contained  in 
the  Flammable  and  Combustible  Liquids  Code,  NFPA  No.  30- 
1976.  Flammable  and  combustible  liquids  are  defined  as 
follows : 


Flammable  Liquid  shall  mean  a liquid  having 
a flash  point  below  100°  F (37.8°  C)  and  having  a 
vapor  pressure  not  exceeding  40  pounds  per  square 
inch  (absolute)  at  100°  F (37.8°  C)  and  shall  be 
known  as  a Class  I liquid. 

Class  I liquids  shall  be  subdivided  as  follows: 

Class  IA  shall  include  those  having  flash 
points  below  73°  F (22.8°  C)  and  having  a boiling 
point  below  100°  F (37.8°  C)  .. 


Class  IB  shall  include  those  having  flash 
points  below  73°  F (22.8°  C)  and  having  a boiling 
point  at  or  above  100°  F (37.8°  C)  . 


Class  IC  shall  include  those  having  flash 
points  at  or  above  73°  F (22.8°  C)  and  below 
100°  F (37.8°  C) . 

Combustible  Liquid  shall  mean  a liquid  having 
a flash  point  at  or  above  100°  F (37.8°  C)  . 

Combustible  Liquids  shall  be  subdivided 
as  follows: 


Class  II  liquids  shall  include  those  having 
flash  points  at  or  above  100°  F (37.8°  C)  and 
below  140°  F (60°  C) . 


Class  IIIA  liquids  shall  include  those  having 
flash  points  at  or  above  140°  F (60°  C)  and  below 
200°  F (93.4°  C) . 


Class  1 1 1 B liquids  shall 
flash  points  at  or  above  200° 


include  those  having 
F (93.4°  C)  . 
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Safety  Can  is  defined  as  follows: 

Safety  Can  shall  mean  an  approved  container, 
of  not  more  than  five  gallons  capacity,  having  a 
spring -closing  lid  and  spout  cover  and  so  designed 
that  it  will  safely  relieve  internal  pressure 
when  subjected  to  fire  exposure. 

The  citation  of  this  definition  does  not  necessarily  indicate 
that  the  gasoline  and  kerosene  containers  to  be  standardized 
for  home  use  must  correspond  to  this  definition  in  all 
particulars . 

The  standards  available  for  this  study  are  UL-30, 
Standard  for  Safety,  Metal  Safety  Cans;  PS  61-74,  Voluntary 
Product  Standard  for  Plastic  Containers  (Jerry  Cans)  for 
Petroleum  Products;  and  the  Factory  Mutual  Research  Approval 
Standard  for  Safety  Containers  and  Filling  Supply  and  Disposa 
Containers.  The  RR-S-30F  Federal  Specification  for  Safety 
Can,  Spring  Closing  Type  is  also  cited.  The  provisions 
of  these  documents  are  summarized  in  Table  I of  this  Appendix 
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PS  6174  Structural  integrity  3.2.3  Standards  for  burning  rate  and  for  flammability 

- flammability  3.12  resistance  as  a factor  in  leakage. 
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APPENDIX  3 


\ 


FUNCTIONAL  FAILURE 


The  following  scenarios  illustrate  accident  event 
sequences  for  eight  functional  failure  modes: 

1.  Child  Access  Prevention  - Ingestion 
Sequence  4g+2k+2e2-»-5f 

The  subject's  father  had  used  gasoline  in  a plastic 
measuring  cup  to  start  a lawn  mower.  When  he  succeeded 
in  starting  the  mower,  he  proceded  to  mow  the  lawn  in  the 
rear  of  the  house,  leaving  the  cup  about  half  filled  with 
gasoline  on  the  steps  of  the  back  porch.  His  three  year 
old  son  came  out  of  the  house,  drank  the  gasoline  and  began 
to  choke  and  cry.  The  father  took  the  child  immediately 
to  the  emergency  room  of  the  local  hospital.  The  child 
was  treated  for  digestive  upset  and  kept  in  the  hospital 
for  observation  to  determine  if  any  gasoline  had  entered 
the  lungs . 

2.  Child  Access  Prevention  - Burn 

3b  3h  5b 

Sequence  4g->-2a+2g->-  | -»•  | -*4b->| 

3d  3i  5d 

The  four  year  old  child  was  playing  in  the  basement 
of  the  home.  He  found  a five  gallon  glass  jug  about  three 
quarters  full  of  gasoline  which  his  older  brother  kept 
for  his  mini  bike.  The  child  poured  the  gasoline  in  an 
old  pan  and  started  to  wash  a small  toy.  The  gasoline 
ignited  from  the  pilot  light  of  a hot  water  heater.  The 
gasoline  ignited  in  the  pan  and  on  the  child's  hands  and 
arms.  The  child's  mother  heard  the  child  screaming,  ran 
into  the  basement  and  smothered  the  flames  on  the  child 
with  a nearby  throw  rug.  The  child  was  taken  to  a burn 

unit  at  the  hospital.  The  child  received  severe 

burns  on  his  hands  and  both  arms  with  less  severe  burns 
on  his  neck  and  face. 

3.  Dispensing 


3a 

Sequence  2a-*-4c-*-2b+ 1 -*3g-*5d 

3c 


63 


The  subject  poured  gasoline  on  a barbcque  from  a five 
gallon  gasoline  can.  He  poured  gasoline  on  his  trousers. 
He  set  the  can  aside  and  dropped  a lighted  match  on  the 
barbeque.  The  barbeque  flared  up  and  his  pants  ignited. 

He  hastily  removed  his  pants.  He  then  drove  to  a local 
hospital  where  he  was  treated  for  moderate  burns  on  his 
legs . 


4.  Containment,  Passive 

3 a 

Sequence  2a-*2c-Mc->  | +3g->-5d 

3c 

The  subject  poured  gasoline  on  a smouldering  pile 
of  leaves  from  a coffee  can.  The  leaves  flared  up  and 
the  man  jumped  back  suddenly  and  spilled  the  gasoline  on 
his  trousers.  The  gasoline  caught  fire  on  his  clothes. 

The  man  rolled  on  the  ground  to  extinguish  the  fire.  His 

wife  drove  him  to  the  burn  unit  at  hospital  where 

he  was  treated  for  burns  on  his  upper  legs. 

5.  Barrier  and  Containment,  Active 

3a  5a 

Sequence  2a+|  +3h-»-4a+ 1 
3d  5c 

The  subject  poured  gasoline  from  a five  gallon  gasoline 
can  on  a smouldering  barbeque.  The  fire  flashed  back  up 
the  stream  of  gas  and  the  container  exploded.  The  man 
was  splashed  with  flaming  gasoline.  He  was  rolled  on  the 
ground  by  his  wife  and  brother  to  extinguish  the  flames. 

He  was  taken  to  a burn  unit  at  hospital.  He  was 

hospitalized  for  severe  burns  on  his  upper  body  and  chest. 

6.  Handling  and  Stability 

3b 

Sequence  2f+2i-*-4d->- 1 -*-3f+5b 

3d 

The  subject  went  to  the  basement  to  obtain  a five 
gallon  can  of  gasoline.  He  was  carrying  the  can  by  the 
handle  when  it  slipped  from  his  hand  and  overturned.  When 
it  hit  the  floor,  the  gasoline  spilled  from  the  spout  of 
the  can  and  was  ignited  on  the  floor  by  the  pilot  light 
of  a hot  water  heater.  The  pool  of  gasoline  flared  up 
and  the  flame  burned  the  subject.  The  subject  drove  to 
the  office  of  his  family  physician  where  he  was  treated 
for  moderate  burns  around  his  ankles  and  lower  legs. 
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7.  Identification 


3a 

Sequence  2k-*2a+|  ->-3f->-5b 

3d 

The  subject's  husband  had  used  a small  pail  of  gasoline 
to  start  a trash  fire.  He  left  the  pail,  with  some  gasoline 
in  it,  sitting  on  the  ground  about  200  feet  from  the  fire 
and  near  an  outdoor  faucet  while  he  went  for  more  trash. 

The  subject  came  out  of  the  house  and  noticed  that  the 
fire  was  spreading  toward  some  dry  grass.  She  assumed 
the  pail  contained  water  and  poured  the  gasoline  from  it 
on  the  edge  of  the  fire.  The  gasoline  flared  up  and  ignited 
her  skirt.  She  quickly  removed  her  skirt  but  not  before 
she  had  received  slight  to  moderate  burns  around  one  leg. 

8.  Storage  and  Structural  Integrity* 


Sequence  2 j+4h->-4 j + 5j 

The  subject*  purchased  a two  gallon  gasoline  can  on 
June  20,  1977  at  an  auto  supply  store.  The  can  was  of 
steel  construction  and  had  a steel  spout  which  was  stored 
inside  the  can  by  screwing  the  base  of  the  spout  into  the 
filling/pouring  outlet.  When  in  the  stored  position  a 
second  cap  screwed  inside  the  base  of  the  spout  to  form 
a cap  for  the  otherwise  open  outlet.  A small  plastic  "flip 
to  vent"  cap  was  installed  in  the  top  of  the  can  in  the 
corner  opposite  to  the  spout.  There  was  a removable  cork 
seal  in  the  screw  base  of  the  spout  assembly  covering  the 
spout  opening.  The  container  was  stored  about  three  - fourths 
full  of  gasoline  in  a garage  during  the  hot  weather  of 
July  1977.  During  the  week  of  July  27,  the  subject's  wife 
noticed  that  the  top  of  the  container  was  covered  with 
gasoline  and  the  hollow,  cup-like  top  of  the  screw  top 
over  the  spout  base  was  filled  with  gasoline.  Upon  examination, 
initially  by  the  subject  and  later  by  the  present  writer, 
the  container  was  found  to  be  structurally  intact.  The 
subject  states  that  vapor  pressure  above  the  gasoline  in 
the  can  had  forced  gasoline  up  through  the  stored  spout. 

The  gasoline  penetrated  the  cork  seal  and  leaked  through 
the  screw  cap  above  the  spout  opening  to  collect  on  top 


*This  scenario  was  provided  by  Dr.  R.J.  Lepkowski,  Office 
of  Energy  Related  Inventions,  Institute  for  Applied  Tech- 
nology, National  Bureau  of  Standards,  Washington,  D.C. 


' r- 
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the  can  and  in  the  top  of  the  screw  cap.  The  subject 
states  that  no  gasoline  was  found  to  have  been  released 
through  the  ‘'flip  to  vent"  cap.  It  should  be  noted  that 
the  subject  is  anosmic  (defective  sense  of  smell)  and  frequently 
smokes  a pipe.  He,  therefore,  could  have  entered  into 
a potential  gasoline  explosion  situation  with  no  warning. 
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